Splunk Search

how can i change column values to field names

kirrusk
Communicator

i'm trying to convert values in column to fields names, But not able to achieve.

table is like 

ENV       LABEL          APP

PR1       labelp1       APP1

PR1      labelp11     APP2

PR2      labelp2       APP1

PR2      labelp22    APP2

 

i'm trying to achieve

PR1                    PR2           APP

labelp1          labelp2        APP1

labelp11       labelp22     APP2

 

Can any one help on this

 

 

 

Labels (9)
0 Karma

mdorobek
Path Finder

Hello,

this might be a quick and dirty solution but it should work:

| ...
| stats values(LABEL) by ENV
| transpose header_field=ENV
| eval combine=mvzip(PR1,PR2,"|")
| fields combine
| mvexpand combine
| eval PR1=mvindex(split(combine,"|"), 0)
| eval PR2=mvindex(split(combine,"|"), 1)
| fields - combine

regards,
mdorobek

kirrusk
Communicator

@mdorobek  have updated question pls suggest on this

0 Karma

mdorobek
Path Finder

Hello,

heres the solution after the update:

 

 

...
| eval _raw=ENV+"="+LABEL
| extract
| stats values(PR1) as PR1 values(PR2) as PR2 by APP

 

However, this might need some further steps if you have multiple combinations of PR2/PR1 and App. 
If it doesnt solve your requirements a little more context would help to find the correct solution. 

Heres a possible solution, but you have to be aware, that this depends on the arrangement of your data and might not give correct results if you have another arrangement. 

 

| eval _raw=ENV+"="+LABEL
| extract
| stats values(PR1) as PR1 values(PR2) as PR2 by APP
| eval combined=mvzip(PR1,PR2,"|")
| fields - PR1, PR2
| mvexpand combined
| eval PR1=mvindex(split(combined,"|"),0)
| eval PR2=mvindex(split(combined,"|"),1)
| fields - combined

 

regards,
mdorobek

 

 

0 Karma

kirrusk
Communicator

@mdorobek  not working as expected , it is giving column like 

 

App        PR1           PR2

 App1   label11    label2

               label12    label21

                 ..                 ..

App2     labell1      label2

                label11    label22

 

 

    

 

0 Karma

mdorobek
Path Finder

Thats exactly what I meant with "However, this might need some further steps if you have multiple combinations of PR2/PR1 and App. " I updated the answer.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...